This is a simple Windbg script to monitor common Win32 API calls and display the strings, IPs, Ports, Registry keys passed to the APIs. The Win32 API is huge and I have used common APIs used by programs and malware. I coded this for fun 🙂

Usage: ApiMon.wds run; g;

You can remove APIs as you wish to minimize the output or you can add any API you desire. For example

bp DLLName!APIName @"$$>a<${$arg0} APIName FileNamePtr

bp kernelbase!CreateFileA @"$$>a<${$arg0} CreateFileA 1";

This is a sample output that uses CreateProcess API.

This is from running netcat.

Download: https://github.com/OsandaMalith/ApiMon

$$ ApiMon -  A simple API Monitor for Windbg
$$ Author : Osanda Malith Jayathissa (@OsandaMalith)
$$ E-Mail: osanda[cat]unseen.is
$$ Website: https://osandamalith.com 

aS LogPath @"C:\temp\Output.txt";

.catch {

	.if ${/d:$arg1} == 0 {
		.printf "Usage: ApiMon.wds run; g;";
		.leave;
	}

	.if @@masm(not($scmp("${$arg1}", "run"))) {
		 .logopen /t ${LogPath};
		.if @@c++(((unsigned char *)&@$PEB->BeingDebugged)[0]) == @@masm(0y1) {
			r? $t5 = @@c++((unsigned long *)&@$PEB->BeingDebugged);
			eb $t5 @@masm(0y0);
		}

		.if @@c++(((unsigned char *)&@$PEB->NtGlobalFlag)[0]) == @@masm(0y1110000) {
			r? $t6 = @@c++((unsigned long *)&@$PEB->NtGlobalFlag);
			eb $t6 @@masm(0y0);
		}

		$$ Registry
		bp Advapi32!RegOpenKeyA @"$$>a<${$arg0} RegOpenKeyA";
		bp Advapi32!RegOpenKeyW @"$$>a<${$arg0} RegOpenKeyW";

		bp Kernelbase!RegOpenKeyExA @"$$>a<${$arg0} RegOpenKeyExA";
		bp Kernelbase!RegOpenKeyExW @"$$>a<${$arg0} RegOpenKeyExW";

		bp Kernelbase!RegQueryValueExA @"$$>a<${$arg0} RegQueryValueExA";
		bp Kernelbase!RegQueryValueExW @"$$>a<${$arg0} RegQueryValueExW";		

		bp Advapi32!RegQueryValueA @"$$>a<${$arg0} RegQueryValueA";
		bp Advapi32!RegQueryValueW @"$$>a<${$arg0} RegQueryValueW";

		bp Advapi32!RegCopyTreeA @"$$>a<${$arg0} RegCopyTreeA";
		bp Kernelbase!RegCopyTreeW @"$$>a<${$arg0} RegCopyTreeW";

		bp Kernelbase!RegCreateKeyExA  @"$$>a<${$arg0} RegCreateKeyExA";
		bp Kernelbase!RegCreateKeyExW @"$$>a<${$arg0} RegCreateKeyExW";	

		bp Advapi32!RegDeleteKeyA @"$$>a<${$arg0} RegDeleteKeyA";
		bp Advapi32!RegDeleteKeyW @"$$>a<${$arg0} RegDeleteKeyW";

		bp Advapi32!RegDeleteKeyValueA @"$$>a<${$arg0} RegDeleteKeyValueA";
		bp Advapi32!RegDeleteKeyValueW @"$$>a<${$arg0} RegDeleteKeyValueW";

		bp Kernelbase!RegDeleteKeyExA  @"$$>a<${$arg0} RegDeleteKeyExA";
		bp Kernelbase!RegDeleteKeyExW @"$$>a<${$arg0} RegDeleteKeyExW";		

		bp Advapi32!RegDeleteKeyTransactedA @"$$>a<${$arg0} RegDeleteKeyTransactedA";
		bp Advapi32!RegDeleteKeyTransactedW @"$$>a<${$arg0} RegDeleteKeyTransactedW";	

		bp Kernelbase!RegDeleteTreeA @"$$>a<${$arg0} RegDeleteTreeA";
		bp Kernelbase!RegDeleteTreeW @"$$>a<${$arg0} RegDeleteTreeW";	

		bp Kernelbase!RegDeleteValueA @"$$>a<${$arg0} RegDeleteValueA";
		bp Kernelbase!RegDeleteValueW @"$$>a<${$arg0} RegDeleteValueW";	

		bp Kernelbase!RegRestoreKeyA @"$$>a<${$arg0} RegRestoreKeyA";
		bp Kernelbase!RegRestoreKeyW @"$$>a<${$arg0} RegRestoreKeyW";	

		bp Advapi32!RegReplaceKeyA @"$$>a<${$arg0} RegReplaceKeyA";
		bp Advapi32!RegReplaceKeyW @"$$>a<${$arg0} RegReplaceKeyW";	

		bp Advapi32!RegSaveKeyA @"$$>a<${$arg0} RegSaveKeyA";
		bp Advapi32!RegSaveKeyW @"$$>a<${$arg0} RegSaveKeyW";	

		$$ File Operations
		bp kernelbase!CreateFileA @"$$>a<${$arg0} CreateFileA 1";
		bp kernelbase!CreateFileW @"$$>a<${$arg0} CreateFileW 1";
		
		bp kernelbase!DeleteFileA @"$$>a<${$arg0} DeleteFileW 1";
		bp kernelbase!DeleteFileW @"$$>a<${$arg0} DeleteFileW 1";

		bp kernelbase!FindFirstFileA @"$$>a<${$arg0} FindFirstFileA 1";
		bp kernelbase!FindFirstFileW @"$$>a<${$arg0} FindFirstFileW 1";

		bp kernel32!MoveFileA @"$$>a<${$arg0} MoveFileA 1";
		bp kernel32!MoveFileW @"$$>a<${$arg0} MoveFileW 1";

		bp kernelbase!GetFileAttributesA @"$$>a<${$arg0} GetFileAttributesA 1";

		bp kernelbase!GetFileAttributesExA @"$$>a<${$arg0} GetFileAttributesExA 1";
		bp kernelbase!GetFileAttributesExW @"$$>a<${$arg0} GetFileAttributesExW 1";

		bp kernel32!CopyFileA @"$$>a<${$arg0} CopyFileA 1";
		bp kernel32!CopyFileW @"$$>a<${$arg0} CopyFileW 1";

		bp kernel32!GetTempPathA @"$$>a<${$arg0} GetTempPathA 2";
		bp kernelbase!GetTempPathW @"$$>a<${$arg0} GetTempPathW 2";

		$$ Networking APIs
		bp WS2_32!connect @"$$>a<${$arg0} connect";
		bp WS2_32!bind @"$$>a<${$arg0} bind";
		bp WS2_32!WSAConnect @"$$>a<${$arg0} WSAConnect";
		
		bp WS2_32!gethostname @"$$>a<${$arg0} gethostname 1";
		bp WS2_32!gethostbyname @"$$>a<${$arg0} gethostbyname 1";
		
		bp WININET!FtpPutFileA @"$$>a<${$arg0} FtpPutFileA 2";
		bp WININET!FtpPutFileW @"$$>a<${$arg0} FtpPutFileW 2";

		bp WININET!InternetOpenA @"$$>a<${$arg0} InternetOpenA 1";
		bp WININET!InternetOpenW @"$$>a<${$arg0} InternetOpenW 1";

		$$ Others
		bp kernel32!CreateMutexA @"$$>a<${$arg0} CreateMutexA 3";
		bp kernel32!CreateMutexW @"$$>a<${$arg0} CreateMutexW 3";

		bp kernelbase!OutputDebugStringA @"$$>a<${$arg0} OutputDebugStringA 1";
		bp kernelbase!OutputDebugStringW @"$$>a<${$arg0} OutputDebugStringW 1";

		bp kernel32!WinExec @"$$>a<${$arg0} WinExec 1";

		bp SHELL32!ShellExecuteA @"$$>a<${$arg0} ShellExecuteA 3";
		bp SHELL32!ShellExecuteW @"$$>a<${$arg0} ShellExecuteW 3";

		bp KERNELBASE!CreateProcessA @"$$>a<${$arg0} CreateProcessA 1";
		bp KERNELBASE!CreateProcessW @"$$>a<${$arg0} CreateProcessW 1";

		sxi ld;
		.leave;		
	}
	
	.if @@masm(not($scmp("${$arg1}", "bind"))) { 
		.printf /D "<col fg=\"srcnum\"><b>\n${$arg1}\n</b></col>";
 		r $t5 =  @@masm(hi(@@c++(((unsigned long *)(((unsigned long *)@$csp)[2]))[0])));
 		.printf /D "<col fg=\"srcspid\"><b>Port: </b></col>";
 		.printf /D "<col fg=\"srcspid\">%d\n\n</col>", @@masm(hi(@@c++((unsigned long *) (( @$t5 >> 24 ) | (( @$t5 << 8) & 0xff0000 ) | ((@$t5 >> 8) & 0xff00) | ( @$t5 << 24)))));
 		gc;
 		.leave;
	}

	.if @@masm($spat("${$arg1}", "*connect*")) {
		.printf /D "<col fg=\"srcnum\"><b>\n${$arg1}\n</b></col>";
		r? $t0 = @@c++(((unsigned long *)@$csp)[2]) + 4;
		.printf /D "<col fg=\"srcspid\"><b>IP:   </b></col>";
		.printf /D "<col fg=\"srcspid\">%d.%d.%d.%d\n</col>", @@c++(((unsigned char *)@$t0)[0]), @@c++(((unsigned char *)@$t0)[1]), @@c++(((unsigned char *)@$t0)[2]), @@c++(((unsigned char *)@$t0)[3])
		
		r $t5 =  @@masm(hi(@@c++(((unsigned long *)(((unsigned long *)@$csp)[2]))[0])));
 		.printf /D "<col fg=\"srcspid\"><b>Port: </b></col>";
 		.printf /D "<col fg=\"srcspid\">%d\n\n</col>", @@masm(hi(@@c++((unsigned long *) (( @$t5 >> 24 ) | (( @$t5 << 8) & 0xff0000 ) | ((@$t5 >> 8) & 0xff00) | ( @$t5 << 24)))));
		gc;
		.leave;
	}

	.if @@masm($spat("${$arg1}", "Reg*")) {
		r $t6 = @@c++(((unsigned long *)@$csp)[2]);
		r $t7 = @@masm(low(@@c++(((unsigned long *)@$csp)[1])));

		.printf /D "<col fg=\"srckw\"><b>\n${$arg1}\n</b></col>";

		.if @$t7 == 0x0 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_CLASSES_ROOT\n</col>";
		}
		.if @$t7 == 0x1 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_CURRENT_USER\n</col>";
		}
		.if @$t7 == 0x2 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_LOCAL_MACHINE\n</col>";
		}
		.if @$t7 == 0x3 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_USERS\n</col>";
		}
		.if @$t7 == 0x4 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_PERFORMANCE_DATA\n</col>";
		}
		.if @$t7 == 0x50 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_PERFORMANCE_TEXT\n</col>";
		}
		.if @$t7 == 0x60 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_PERFORMANCE_NLSTEXT\n</col>";
		}
		.if @$t7 == 0x5 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_CURRENT_CONFIG\n</col>";
		}
		.if @$t7 == 0x6 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_DYN_DATA\n</col>";
		}
		.if @$t7 == 0x7 {
			.printf /D "<col fg=\"srcspid\"><b>HKEY</b>  : HKEY_CURRENT_USER_LOCAL_SETTINGS\n</col>";
		}

		.if @@masm($spat("${$arg1}", "*A")) {
			.printf /D "<col fg=\"srcspid\"><b>Value</b>: %ma\n\n</col>", @$t6;
			gc;
		}

		.if  @@masm($spat("${$arg1}", "*W")) {
			.printf /D "<col fg=\"srcspid\"><b>Value</b>: %mu\n\n</col>", @$t6;
			gc;
		}
		
		.leave;
	}
	.printf /D "<col fg=\"emphfg\"><b>${$arg1}:  </b></col>"

	r $t4 = @@c++(((unsigned long *)@$csp)[${$arg2}]);

	.if @@masm($spat("${$arg1}", "*A")) {
		
		.printf /D "<col fg=\"srcspid\">%ma\n</col>", @$t4;
		gc;
	}

	.if  @@masm($spat("${$arg1}", "*W")) {
		.printf /D "<col fg=\"srcspid\">%mu\n</col>", @$t4;
		gc;
	}
	
}